Name Resolution Spoofing Detection via Hostname Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems are vulnerable to name resolution spoofing attacks due to the lack of authentication in Link-Local Multicast Name Resolution (LLMNR) and Netbios Name Service (NBNS) protocols, which can lead to malicious responses masquerading as legitimate hostnames, compromising network security.
Innovation Solution
A method and system for detecting name resolution spoofing by monitoring LLMNR/NBNS responses, analyzing the specified hostname against the actual hostname, and performing security actions such as blocking or quarantining suspicious responses, utilizing a whitelist to differentiate legitimate from malicious responses, and generating notifications for incident responders.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If LLMNR/NBNS protocols are used for name resolution, then network functionality is maintained, but security vulnerability increases due to lack of authentication
Solution Approach 1:
The patent introduces a security monitoring system as an intermediary between the LLMNR/NBNS protocols and the name resolution process. This system intercepts and analyzes name resolution responses, comparing specified hostnames against actual hostnames to detect spoofing attempts, thereby maintaining protocol functionality while adding a security layer without disabling the protocols
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring name resolution responses and providing real-time analysis of hostname mismatches. When spoofing is detected, the system can trigger security actions such as blocking the responding device or alerting administrators, creating a closed-loop security system that maintains protocol operation while preventing attacks
2Reliability
If name resolution spoofing detection is implemented, then security improves, but network traffic increases due to monitoring requirements
Solution Approach 1:
The patent extracts only the critical security analysis function from the name resolution process, monitoring specifically for hostname mismatches between specified and actual hostnames in responses. By focusing monitoring on this specific security-relevant parameter rather than all network traffic, the system achieves security detection with minimal overhead
Solution Approach 2:
The system performs partial monitoring by analyzing only the hostname fields in name resolution responses rather than deep packet inspection of all network traffic. This selective monitoring approach provides sufficient security detection capability while minimizing the increase in network traffic and processing resources required
3Measurement precision
If hostname analysis is performed on all responses, then detection accuracy improves, but processing time increases
Solution Approach 1:
The system performs preliminary action by pre-establishing baseline information about legitimate hostnames and implementing efficient comparison algorithms that quickly identify mismatches. By preparing reference data and using optimized string comparison techniques, the system achieves high detection accuracy while minimizing processing time for each response analysis
Solution Approach 2:
The patent segments the hostname analysis process into distinct steps: extracting the specified hostname from the response, retrieving the actual hostname, comparing the two, and determining if a mismatch indicates spoofing. This segmentation allows for optimized processing of each step and enables early termination when spoofing is clearly identified, reducing overall processing time
Data Source
AI summary
A method for detecting name resolution spoofing is described. In one embodiment, the method includes identifying a request to resolve a host name, identifying a hostname specified in a response to the request, identifying an actual hostname associated with the response, analyzing the hostname specified in relation to the actual hostname, and performing a security action based at least in part on the analysis.